We claim: 



CLAIMS 



L A method of operating an intrusion detection system, the method comprising the steps of: 

determining a present alert generation rate of an intrusion detection system; 

comparing the present alert generation rate with an alert generation rate threshold; and 

altering an element of a signature set of the intrusion detection system responsive to an 
outcome of the step of comparing. 

2. A method of operating an intrusion detection sensor, the method comprising the steps of: 

determining a present alert generation rate of an intrusion detection sensor; 

comparing the present alert generation rate with an alert generation rate threshold; and 

when the present alert generation rate exceeds the alert generation rate threshold, altering 
an element of a signature set of the intrusion detection sensor to decrease an alert generation rate 
of the intrusion detection sensor. 
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1 3. The method of claim 2, wherein the element is a signature threshold quantity. 

1 4. The method of claim 2, wherein the element is a signature threshold interval, 

1 5. A method of operating an intrusion detection system, comprising the steps of: 
2P monitoring for occurrence of a signature event; and 

3f if when a signature event occurs, increasing a value of a signature event counter and 

4M comparing the value of the signature event counter with a signature threshold quantity; and 

when the value of the signature event counter exceeds the signature threshold quantity, 

6y generating an alert, recording a time of generating the alert in a log, determining from contents of 

7 the log a present alert generation rate, and comparing the present alert generation rate with an 

8 alert generation rate threshold; and 

9 when the present alert generation rate exceeds the alert generation rate threshold, altering 

10 an element of a signature set of an intrusion detection system to decrease an alert generation rate 

11 of an intrusion detection sensor. 
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6. The method of claim 5, wherein the element is a signature threshold quantity* 

7. The method of claim 5, wherein the element is a signature threshold interval. 

8. Programmable media containing programmable software for operation of an intrusion 
detection system, programmable software comprising the steps of: 

determining a present alert generation rate of an intrusion detection system; 

comparing the present alert generation rate with an alert generation rate threshold; and 

altering an element of a signature set of the intrusion detection system responsive to an 
outcome of the step of comparing. 
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9, Programmable media containing programmable software for operation of an intrusion 
detection sensor, programmable software comprising the steps of: 

determining a present alert generation rate of an intrusion detection sensor; 

comparing the present alert generation rate with an alert generation rate threshold; and 

when the present alert generation rate exceeds the alert generation rate threshold, altering 
an element of a signature set of the intrusion detection sensor to decrease an alert generation rate 
of the intrusion detection sensor. 
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10. Programmable media containing programmable software for operation of an intrusion 
detection system, programmable software comprising the steps of: 

monitoring for occurrence of a signature event; and 

when a signature event occurs, increasing a value of a signature event counter and 
comparing the value of the signature event counter with a signature threshold quantity; and 

when the value of the signature event counter exceeds the signature threshold quantity, 
generating an alert, recording a time of generating the alert in a log, determining from contents of 
the log a present alert generation rate, and comparing the present alert generation rate with an 
alert generation rate threshold; and 

when the present alert generation rate exceeds the alert generation rate threshold, altering 
an element of a signature set of an intrusion detection system to decrease an alert generation rate 
of an intrusion detection server. 
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1 11. The programmable media of claim 10, wherein the element is a signature threshold quantity. 



1 12. The programmable media of claim 10, wherein the element is a signature threshold interval. 
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